MCP server compromise — quick-start

checklist

1. rotate all credentials the MCP server had access to: API keys, OAuth tokens, service account keys — immediately, before attribution.
2. preserve the current tool definition manifest (tools.json or equivalent) before any patch or rollback — the tampered definitions are evidence.
3. export the server's access log and tool-call trace for the incident window — before log rotation.
4. identify which agent sessions connected to the MCP server during the exposure window — each session is a potential blast-radius vector.
5. check whether any tool definition was modified to exfiltrate data, call external endpoints, or return false outputs.
6. identify the vector: leaked server credentials, supply-chain compromise of a dependency, or direct server access.
7. pull the git history or deployment log for the MCP server — look for unauthorized pushes or config changes.
8. notify all agent operators who connected sessions during the exposure window — their tool outputs may be corrupted.
9. audit any action taken by an agent during the exposure window — MCP tool calls may have triggered irreversible side effects (email sent, payment initiated).
10. begin the primary tool path below — MCP server compromise analyzer.

primary tools

1. 01mcp model context protocol server audit log forensic analyzerdrop mcp server audit log · parse tool calls + resource accesses + auth · runs locally
2. 02mcp client invocation log forensic analyzerdrop mcp client invocation log · parse server calls + arguments + responses · runs locally
3. 03mcp server permission escalation detectordrop mcp server audit log · detect over-permissioned tool exposure · runs locally
4. 04mcp tool call graph reconstructordrop mcp client + server log set · reconstruct tool-call dependency graph · runs locally
5. 05mcp prompt injection via tool result detectordrop mcp server tool result log · detect injection payloads in tool responses · runs locally
6. 06anthropic mcp claude tool call attribution tooldrop claude tool call log · attribute each tool call to model decision · runs locally

go deeper